Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-47398

Publication date:
02/02/2026
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-47399

Publication date:
02/02/2026
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-47402

Publication date:
02/02/2026
Transient DOS when processing a received frame with an excessively large authentication information element.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-15395

Publication date:
02/02/2026
IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-47358

Publication date:
02/02/2026
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-47359

Publication date:
02/02/2026
Memory Corruption when multiple threads simultaneously access a memory free API.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-47363

Publication date:
02/02/2026
Memory corruption when calculating oversized partition sizes without proper checks.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-47364

Publication date:
02/02/2026
Memory corruption while calculating offset from partition start point.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2025-14914

Publication date:
02/02/2026
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2026-1703

Publication date:
02/02/2026
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Severity CVSS v4.0: LOW
Last modification:
02/02/2026

CVE-2022-50980

Publication date:
02/02/2026
A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026

CVE-2022-50981

Publication date:
02/02/2026
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2026